CVE-2026-40459 HIGH

CVE-2026-40459: LDAP Injection in PAC4J

Vendor Pac4J
Product PAC4J
Weakness CWE-90 · LDAP injection
Published April 17, 2026
Last update April 17, 2026
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

PAC4J is vulnerable to LDAP Injection in multiple methods. A low-privileged remote attacker can inject crafted LDAP syntax into ID-based search parameters, potentially resulting in unauthorized LDAP queries and arbitrary directory operations. This issue was fixed in PAC4J versions 4.5.10, 5.7.10 and 6.4.1

Key dates

02Disclosure timeline

April 17, 2026 CVE published
April 17, 2026 Record updated